Skip to content
This repository was archived by the owner on Jun 24, 2022. It is now read-only.

Commit 21e58d1

Browse files
author
[email protected]
committed
Sign MacroAssembler::jumpsToLink
https://bugs.webkit.org/show_bug.cgi?id=217774 <rdar://problem/69433058> Reviewed by Saam Barati. Source/JavaScriptCore: * assembler/ARM64Assembler.h: (JSC::ARM64Assembler::LinkRecord::LinkRecord): (JSC::ARM64Assembler::LinkRecord::setFrom): (JSC::ARM64Assembler::LinkRecord::to const): (JSC::ARM64Assembler::linkJump): * assembler/LinkBuffer.cpp: (JSC::LinkBuffer::copyCompactAndLinkCode): Source/WTF: * wtf/PtrTag.h: (WTF::untagInt): (WTF::tagInt): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@269020 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent f1a5cb2 commit 21e58d1

File tree

5 files changed

+115
-13
lines changed

5 files changed

+115
-13
lines changed

‎Source/JavaScriptCore/ChangeLog

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
2020-10-15 Tadeu Zagallo <[email protected]>
2+
3+
Sign MacroAssembler::jumpsToLink
4+
https://bugs.webkit.org/show_bug.cgi?id=217774
5+
<rdar://problem/69433058>
6+
7+
Reviewed by Saam Barati.
8+
9+
* assembler/ARM64Assembler.h:
10+
(JSC::ARM64Assembler::LinkRecord::LinkRecord):
11+
(JSC::ARM64Assembler::LinkRecord::setFrom):
12+
(JSC::ARM64Assembler::LinkRecord::to const):
13+
(JSC::ARM64Assembler::linkJump):
14+
* assembler/LinkBuffer.cpp:
15+
(JSC::LinkBuffer::copyCompactAndLinkCode):
16+
117
2020-10-15 Tadeu Zagallo <[email protected]>
218

319
Validate addresses returned by LinkBuffer::locationOf

‎Source/JavaScriptCore/assembler/ARM64Assembler.h

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -340,28 +340,43 @@ class ARM64Assembler {
340340

341341
class LinkRecord {
342342
public:
343-
LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition)
343+
LinkRecord(const ARM64Assembler* assembler, intptr_t from, intptr_t to, JumpType type, Condition condition)
344344
{
345345
data.realTypes.m_from = from;
346+
#if CPU(ARM64E)
347+
data.realTypes.m_to = tagInt(to, static_cast<PtrTag>(from ^ bitwise_cast<intptr_t>(assembler)));
348+
#else
349+
UNUSED_PARAM(assembler);
346350
data.realTypes.m_to = to;
351+
#endif
347352
data.realTypes.m_type = type;
348353
data.realTypes.m_linkType = LinkInvalid;
349354
data.realTypes.m_condition = condition;
350355
}
351-
LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition, bool is64Bit, RegisterID compareRegister)
356+
LinkRecord(const ARM64Assembler* assembler, intptr_t from, intptr_t to, JumpType type, Condition condition, bool is64Bit, RegisterID compareRegister)
352357
{
353358
data.realTypes.m_from = from;
359+
#if CPU(ARM64E)
360+
data.realTypes.m_to = tagInt(to, static_cast<PtrTag>(from ^ bitwise_cast<intptr_t>(assembler)));
361+
#else
362+
UNUSED_PARAM(assembler);
354363
data.realTypes.m_to = to;
364+
#endif
355365
data.realTypes.m_type = type;
356366
data.realTypes.m_linkType = LinkInvalid;
357367
data.realTypes.m_condition = condition;
358368
data.realTypes.m_is64Bit = is64Bit;
359369
data.realTypes.m_compareRegister = compareRegister;
360370
}
361-
LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition, unsigned bitNumber, RegisterID compareRegister)
371+
LinkRecord(const ARM64Assembler* assembler, intptr_t from, intptr_t to, JumpType type, Condition condition, unsigned bitNumber, RegisterID compareRegister)
362372
{
363373
data.realTypes.m_from = from;
374+
#if CPU(ARM64E)
375+
data.realTypes.m_to = tagInt(to, static_cast<PtrTag>(from ^ bitwise_cast<intptr_t>(assembler)));
376+
#else
377+
UNUSED_PARAM(assembler);
364378
data.realTypes.m_to = to;
379+
#endif
365380
data.realTypes.m_type = type;
366381
data.realTypes.m_linkType = LinkInvalid;
367382
data.realTypes.m_condition = condition;
@@ -378,8 +393,24 @@ class ARM64Assembler {
378393
return *this;
379394
}
380395
intptr_t from() const { return data.realTypes.m_from; }
381-
void setFrom(intptr_t from) { data.realTypes.m_from = from; }
382-
intptr_t to() const { return data.realTypes.m_to; }
396+
void setFrom(const ARM64Assembler* assembler, intptr_t from)
397+
{
398+
#if CPU(ARM64E)
399+
data.realTypes.m_to = tagInt(to(assembler), static_cast<PtrTag>(from ^ bitwise_cast<intptr_t>(assembler)));
400+
#else
401+
UNUSED_PARAM(assembler);
402+
#endif
403+
data.realTypes.m_from = from;
404+
}
405+
intptr_t to(const ARM64Assembler* assembler) const
406+
{
407+
#if CPU(ARM64E)
408+
return untagInt(data.realTypes.m_to, static_cast<PtrTag>(data.realTypes.m_from ^ bitwise_cast<intptr_t>(assembler)));
409+
#else
410+
UNUSED_PARAM(assembler);
411+
return data.realTypes.m_to;
412+
#endif
413+
}
383414
JumpType type() const { return data.realTypes.m_type; }
384415
JumpLinkType linkType() const { return data.realTypes.m_linkType; }
385416
void setLinkType(JumpLinkType linkType) { ASSERT(data.realTypes.m_linkType == LinkInvalid); data.realTypes.m_linkType = linkType; }
@@ -2526,21 +2557,21 @@ class ARM64Assembler {
25262557
{
25272558
ASSERT(to.isSet());
25282559
ASSERT(from.isSet());
2529-
m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition));
2560+
m_jumpsToLink.append(LinkRecord(this, from.m_offset, to.m_offset, type, condition));
25302561
}
25312562

25322563
void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition, bool is64Bit, RegisterID compareRegister)
25332564
{
25342565
ASSERT(to.isSet());
25352566
ASSERT(from.isSet());
2536-
m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition, is64Bit, compareRegister));
2567+
m_jumpsToLink.append(LinkRecord(this, from.m_offset, to.m_offset, type, condition, is64Bit, compareRegister));
25372568
}
25382569

25392570
void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition, unsigned bitNumber, RegisterID compareRegister)
25402571
{
25412572
ASSERT(to.isSet());
25422573
ASSERT(from.isSet());
2543-
m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition, bitNumber, compareRegister));
2574+
m_jumpsToLink.append(LinkRecord(this, from.m_offset, to.m_offset, type, condition, bitNumber, compareRegister));
25442575
}
25452576

25462577
static void linkJump(void* code, AssemblerLabel from, void* to)

‎Source/JavaScriptCore/assembler/LinkBuffer.cpp

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -292,10 +292,15 @@ void LinkBuffer::copyCompactAndLinkCode(MacroAssembler& macroAssembler, JITCompi
292292
// Calculate absolute address of the jump target, in the case of backwards
293293
// branches we need to be precise, forward branches we are pessimistic
294294
const uint8_t* target;
295-
if (jumpsToLink[i].to() >= jumpsToLink[i].from())
296-
target = codeOutData + jumpsToLink[i].to() - offset; // Compensate for what we have collapsed so far
295+
#if CPU(ARM64)
296+
const intptr_t to = jumpsToLink[i].to(&macroAssembler.m_assembler);
297+
#else
298+
const intptr_t to = jumpsToLink[i].to();
299+
#endif
300+
if (to >= jumpsToLink[i].from())
301+
target = codeOutData + to - offset; // Compensate for what we have collapsed so far
297302
else
298-
target = codeOutData + jumpsToLink[i].to() - executableOffsetFor(jumpsToLink[i].to());
303+
target = codeOutData + to - executableOffsetFor(to);
299304

300305
JumpLinkType jumpLinkType = MacroAssembler::computeJumpType(jumpsToLink[i], codeOutData + writePtr, target);
301306
// Compact branch if we can...
@@ -307,7 +312,11 @@ void LinkBuffer::copyCompactAndLinkCode(MacroAssembler& macroAssembler, JITCompi
307312
recordLinkOffsets(m_assemblerStorage, jumpsToLink[i].from() - delta, readPtr, readPtr - writePtr);
308313
}
309314
}
315+
#if CPU(ARM64)
316+
jumpsToLink[i].setFrom(&macroAssembler.m_assembler, writePtr);
317+
#else
310318
jumpsToLink[i].setFrom(writePtr);
319+
#endif
311320
}
312321
} else {
313322
if (ASSERT_ENABLED) {
@@ -349,7 +358,12 @@ void LinkBuffer::copyCompactAndLinkCode(MacroAssembler& macroAssembler, JITCompi
349358

350359
for (unsigned i = 0; i < jumpCount; ++i) {
351360
uint8_t* location = codeOutData + jumpsToLink[i].from();
352-
uint8_t* target = codeOutData + jumpsToLink[i].to() - executableOffsetFor(jumpsToLink[i].to());
361+
#if CPU(ARM64)
362+
const intptr_t to = jumpsToLink[i].to(&macroAssembler.m_assembler);
363+
#else
364+
const intptr_t to = jumpsToLink[i].to();
365+
#endif
366+
uint8_t* target = codeOutData + to - executableOffsetFor(to);
353367
if (useFastJITPermissions())
354368
MacroAssembler::link<memcpyWrapper>(jumpsToLink[i], outData + jumpsToLink[i].from(), location, target);
355369
else

‎Source/WTF/ChangeLog

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
2020-10-15 Tadeu Zagallo <[email protected]>
2+
3+
Sign MacroAssembler::jumpsToLink
4+
https://bugs.webkit.org/show_bug.cgi?id=217774
5+
<rdar://problem/69433058>
6+
7+
Reviewed by Saam Barati.
8+
9+
* wtf/PtrTag.h:
10+
(WTF::untagInt):
11+
(WTF::tagInt):
12+
113
2020-10-15 Tadeu Zagallo <[email protected]>
214

315
Add extra validation to MetaAllocator::findAndRemoveFreeSpace

‎Source/WTF/wtf/PtrTag.h

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,13 @@ inline PtrType untagCFunctionPtr(PtrType ptr) { return untagCFunctionPtrImpl<Ptr
410410

411411
#if CPU(ARM64E)
412412

413+
template <typename IntType>
414+
inline IntType untagInt(IntType ptrInt, PtrTag tag)
415+
{
416+
static_assert(sizeof(IntType) == sizeof(uintptr_t));
417+
return bitwise_cast<IntType>(ptrauth_auth_data(bitwise_cast<void*>(ptrInt), ptrauth_key_process_dependent_data, tag));
418+
}
419+
413420
template<typename T>
414421
inline T* tagArrayPtr(std::nullptr_t ptr, size_t length)
415422
{
@@ -459,7 +466,14 @@ inline PtrType untagCodePtrWithStackPointerForJITCall(PtrType ptr, const void* s
459466
template <PtrTag tag, typename IntType>
460467
inline IntType tagInt(IntType ptrInt)
461468
{
462-
static_assert(sizeof(IntType) == sizeof(uintptr_t), "");
469+
static_assert(sizeof(IntType) == sizeof(uintptr_t));
470+
return bitwise_cast<IntType>(ptrauth_sign_unauthenticated(bitwise_cast<void*>(ptrInt), ptrauth_key_process_dependent_data, tag));
471+
}
472+
473+
template <typename IntType>
474+
inline IntType tagInt(IntType ptrInt, PtrTag tag)
475+
{
476+
static_assert(sizeof(IntType) == sizeof(uintptr_t));
463477
return bitwise_cast<IntType>(ptrauth_sign_unauthenticated(bitwise_cast<void*>(ptrInt), ptrauth_key_process_dependent_data, tag));
464478
}
465479

@@ -519,6 +533,20 @@ inline IntType tagInt(IntType ptrInt)
519533
return ptrInt;
520534
}
521535

536+
template <typename IntType>
537+
inline IntType tagInt(IntType ptrInt, PtrTag)
538+
{
539+
static_assert(sizeof(IntType) == sizeof(uintptr_t));
540+
return ptrInt;
541+
}
542+
543+
template <typename IntType>
544+
inline IntType untagInt(IntType ptrInt, PtrTag)
545+
{
546+
static_assert(sizeof(IntType) == sizeof(uintptr_t));
547+
return ptrInt;
548+
}
549+
522550
inline bool usesPointerTagging() { return false; }
523551

524552
#define WTF_VTBL_FUNCPTR_PTRAUTH(discriminator)
@@ -553,6 +581,7 @@ using WTF::tagCFunction;
553581
using WTF::tagCFunctionPtr;
554582
using WTF::untagCFunctionPtr;
555583
using WTF::tagInt;
584+
using WTF::untagInt;
556585

557586
using WTF::assertIsCFunctionPtr;
558587
using WTF::assertIsNullOrCFunctionPtr;

0 commit comments

Comments
 (0)